CCNA Network Services and Security Practice Test 25 — 15 Questions

Question 1

Match each DHCPv4 message in the DORA process to its role.

Accepted Answer

Discover: Client broadcasts to locate DHCP servers. The DORA process includes Discover (client broadcast), Offer (server response), Request (client accepts), and Ack (server confirms). Additional messages like NAK and Decline handle errors.

Answer

Discover: Server responds with an IP lease offer

Answer

Discover: Client requests the offered IP address

Answer

Discover: Server acknowledges the lease

Question 2

An engineer successfully authenticates to a controller and receives a token. What is the usual reason for including that token in later API requests?

Accepted Answer

To identify and authorize the client without resending full login credentials each time. The token proves the client has already authenticated and is authorized to continue interacting with the API for the lifetime of that token or session. It is commonly sent in an HTTP header such as Authorization. It does not replace the need for IP routing or DNS resolution.

Answer

To convert HTTP requests into SNMP traps

Answer

To elect the active controller in the cluster

Answer

To compress JSON payloads before transport

Question 3

A user reports that their desk port stopped working immediately after they connected a small switch. The interface shows err-disabled, and the log mentions BPDU Guard. What most likely happened?

Accepted Answer

The port received a BPDU and BPDU Guard shut it down.. BPDU Guard is commonly enabled on PortFast access ports to protect the topology. If the port receives a BPDU, the switch assumes another switch may have been connected and places the port into err-disabled state. That is exactly the protective behavior you want at the edge.

Answer

DHCP snooping blocked the user's ARP requests.

Answer

Port security moved the port to protect mode.

Answer

The trunk native VLAN matched incorrectly.

Question 4

An ACL entry reads:

access-list 25 permit 192.168.8.0 0.0.0.15

Which address range does this statement match?

Accepted Answer

192.168.8.0 through 192.168.8.15. A wildcard of 0.0.0.15 means the last 4 bits can vary, which corresponds to a block size of 16 addresses. Starting at 192.168.8.0, the range is 192.168.8.0 through 192.168.8.15.

Answer

192.168.8.0 through 192.168.8.31

Answer

192.168.8.0 through 192.168.8.7

Answer

Only host 192.168.8.15

Question 5

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

Accepted Answer

Gi0/1 on SW2 is the root port.. The root bridge has the lowest bridge ID. SW1 is the root because its bridge ID is lower than SW2's local bridge ID. On a non-root switch, the port with the best path toward the root becomes the root port, so Gi0/1 is the root port here.

Answer

SW2 is the root bridge for VLAN 10.

Answer

All SW2 ports in VLAN 10 must be designated ports.

Answer

STP is disabled because the priorities are equal.

Question 6

R1 and R2 should form an OSPF adjacency on their shared GigabitEthernet link, but they remain stuck in EXSTART. What is the most likely cause?

Accepted Answer

The interface MTU values do not match.. The MTU values do not match. OSPF neighbors can discover each other and even move through earlier states, but an MTU mismatch commonly leaves them stuck in EXSTART or EXCHANGE because the routers do not agree on database description packet sizing. Area mismatch, network mismatch, and passive-interface issues usually prevent a much earlier stage of adjacency formation.

Answer

The routers are using different OSPF areas.

Answer

One side is configured as passive-interface.

Answer

The subnet mask on the link is incorrect.

Question 7

R1 learns three OSPF routes to different destinations:

O 10.10.10.0/24
O IA 10.20.20.0/24
O E2 10.30.30.0/24

Which statement is correct about these route types?

Accepted Answer

O E2 is an OSPF external type 2 route.. An O route is intra-area, O IA is interarea, and O E2 is an external type 2 route redistributed into OSPF. The codes describe route origin, not just preference. CCNA expects you to identify them quickly when reading the routing table.

Answer

O IA is an external route redistributed from another routing protocol.

Answer

O means the route was learned through EIGRP.

Answer

All three routes were learned from the same OSPF area type.

Question 8

A wireless site reports that users can connect to the SSID, but performance drops sharply around the conference area whenever the room fills up. Based on the exhibit, what is the most likely cause?

Accepted Answer

Adjacent-channel interference caused by overlapping 2.4 GHz channels. The 2.4 GHz radios are using overlapping channels. In 2.4 GHz, the standard non-overlapping channels are 1, 6, and 11 in many regulatory domains. Using channels 1, 3, and 6 creates adjacent-channel interference, which hurts throughput especially in dense client areas.

Answer

A DHCP exhaustion problem on the WLAN

Answer

An authentication mismatch between the APs and clients

Answer

A missing default route on the wireless controller

Question 9

Hosts on the inside network can reach the internet, but return traffic is failing after a new router was installed. The router's configuration shows that the LAN-facing interface has been configured with 'ip nat outside' and the WAN-facing interface with 'ip nat inside'. What configuration mistake is the most likely cause?

Accepted Answer

The NAT inside and outside interface roles are reversed.. NAT overload requires the LAN-facing interface to be marked as ip nat inside and the WAN-facing interface as ip nat outside. The exhibit shows those roles reversed, so translations will not occur correctly. The ACL itself is fine for matching the inside subnet.

Answer

The ACL must deny RFC1918 traffic before NAT can work.

Answer

PAT cannot use an interface address for overload.

Answer

The inside subnet must be configured as /24 on both interfaces.

Question 10

An ACL on R1 contains only these entries:
access-list 101 permit tcp 10.10.10.0 0.0.0.255 any eq 443
access-list 101 permit icmp any any

What happens to an HTTP packet sourced from 10.10.10.25 and destined for 198.51.100.10 if ACL 101 is applied in the traffic path?

Accepted Answer

It is denied by the implicit deny.. HTTP uses TCP port 80, not 443. Because the ACL does not include a permit for that traffic, it is dropped by the implicit deny at the end of the ACL. The ICMP entry is irrelevant because the packet is TCP.

Answer

It is permitted because the source subnet is allowed.

Answer

It is translated by NAT before the ACL is checked.

Answer

It is converted to HTTPS automatically.

Question 11

Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?

Accepted Answer

Change the helper address on interface Vlan20 to 10.50.0.10.. The SVI for VLAN 20 is forwarding DHCP requests to the wrong helper address. DHCP relay depends on the Layer 3 interface for that VLAN sending client broadcasts to the correct server. Trunks, access ports, and the DHCP pool name on the server are not the first issue shown here. DHCP snooping can filter DHCP server replies on untrusted ports, but since other VLANs are working and no trust misconfiguration is indicated, the root cause is the incorrect ip helper-address on Vlan20.

Answer

Convert the VLAN 20 user ports to trunk mode.

Answer

Configure a default gateway on the user PCs manually.

Answer

Disable DHCP snooping on VLAN 20.

Question 12

Two switches are configured to form an EtherChannel, but the bundle never comes up. Which explanation best describes this scenario?

Accepted Answer

LACP active on one side is incompatible with mode on on the other side.. One side is using LACP active mode and the other side is forcing a static channel-group with mode on. Those modes are not compatible. LACP needs active or passive on both sides, while PAgP uses desirable or auto, and static mode on expects a manual bundle on the other side.

Answer

The switches are using different native VLANs.

Answer

Both sides must use PAgP desirable mode.

Answer

The interfaces must be configured as routed ports first.

Question 13

Which OSPF neighbor state indicates that the routers have already exchanged full link-state databases?

Accepted Answer

FULL. FULL means the adjacency is complete and database synchronization has finished. States such as INIT, 2-WAY, EXSTART, and EXCHANGE all occur earlier in the process.

Answer

2-WAY

Answer

EXSTART

Answer

INIT

Question 14

A switch interface connected to a Cisco IP phone with a PC behind it must carry voice and data correctly. Which two switchport commands are appropriate on that access port?

Accepted Answer

switchport access vlan 10. The access VLAN carries the workstation data traffic, and the voice VLAN carries tagged voice traffic for the IP phone. That is the standard campus switchport design for a phone with a PC behind it. The port itself remains an access port, but the two most directly relevant commands here are the access VLAN and voice VLAN assignments.

Answer

switchport mode trunk

Answer

channel-group 1 mode active

Answer

spanning-tree cost 1

Question 15

An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?

Accepted Answer

In the HTTP Authorization header. Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.

Answer

In the Ethernet trailer

Answer

In the DNS response section

Answer

In the TCP checksum field